Binance Faces Billions in Withdrawals After Record $6.3 Billion Security Breach

Binance, the world’s largest cryptocurrency exchange, is facing substantial withdrawals following a major security breach that reportedly resulted in approximately $6.3 billion worth of cryptocurrency being stolen. After temporarily suspending withdrawals, the exchange began restoring services in stages on Sunday, November 1, 2026. Customers responded by moving billions of dollars in digital assets away from the platform. According to Binance, the exchange recorded approximately $3.64 billion in net outflows during the first nine and a half hours after withdrawals resumed. The figure represents around 2.1% of its reported $171 billion in total assets as of October 28. The incident has become a major test of customer confidence in the platform.

The scale of the withdrawals has continued to attract attention from cryptocurrency analysts. Binance reported processing approximately $4.65 billion in withdrawals against $1.01 billion in deposits during the initial reopening period. However, blockchain analytics platform DefiLlama reported higher outflow figures based on movements across wallets associated with the exchange. Some subsequent estimates placed the total above $6 billion, although wallet movements do not necessarily represent customer withdrawals because they can include transfers between addresses controlled by Binance. This difference in measurement is important when assessing the actual amount of money leaving the exchange. Nevertheless, the available figures demonstrate that many customers moved their assets after withdrawal services became available again.

The security incident has also attracted international attention because of its reported connection to North Korean cybercriminal activity. The United States Federal Bureau of Investigation attributed the attack to TraderTraitor, a hacking group linked to North Korea. According to investigators, the stolen cryptocurrency was subsequently moved through multiple transactions, with some assets converted into Ethereum. Blockchain intelligence companies have also examined the movement of the stolen funds and identified patterns associated with previous attacks. The FBI has warned cryptocurrency businesses and other industry participants to remain alert for transactions connected to the stolen assets. The incident highlights the growing sophistication of cyberattacks targeting major cryptocurrency platforms and the difficulty of recovering digital assets once they have been moved through multiple wallets.

Binance has attempted to reassure customers by promising to absorb the financial impact of the incident rather than pass the losses on to users. The company said it had allocated approximately $6.34 billion from its corporate treasury, Secure Asset Fund for Users (SAFU) and Futures Insurance Fund to cover the affected assets. It also reported that approximately 95% of the stolen assets had been covered through replacement purchases, although the remaining portion involves less liquid cryptocurrencies that may take longer to obtain. Binance has additionally worked with law enforcement, blockchain intelligence firms and other industry partners to trace and freeze assets connected to the attack. The company has said it will replenish its SAFU fund following the use of part of its reserves.

The withdrawals have created opportunities for competing cryptocurrency exchanges as some investors move their funds to alternative platforms. Reports from exchange-flow trackers showed that OKX, Bybit and other platforms recorded net inflows during the same period. However, the movement of funds does not necessarily mean customers are permanently abandoning Binance, as some traders may simply be transferring assets temporarily while monitoring the situation. Bitcoin and Ethereum also experienced price pressure during the period surrounding the incident, although both cryptocurrencies recovered slightly after reaching recent lows. The broader market remains sensitive to developments involving major exchanges because disruptions to trading and withdrawals can affect liquidity and investor confidence.

The incident represents another major warning for the cryptocurrency industry about the importance of cybersecurity, transparent reserves and reliable withdrawal systems. Although Binance has promised to cover the losses and says withdrawals are stabilising, the company will still need to demonstrate that its security controls are strong enough to prevent similar incidents in the future. Investors are also being reminded to remain cautious of fraudulent messages and fake recovery services targeting people affected by the breach. The FBI’s attribution, the ongoing recovery efforts and the exchange’s updated proof-of-reserves information will remain important developments to watch. Ultimately, restoring customer confidence will depend not only on replacing the stolen assets but also on providing transparency and demonstrating stronger protection for users’ .